Updated Date: August 15, 2025
Introduction
Northern Medical Center, an Article 28 facility under New York Public Health Law, is committed to protecting the privacy of our patients and website visitors. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information, including Protected Health Information (PHI) as defined by the Health Insurance Portability and Accountability Act of 1996 (HIPAA), and other data collected through our website. By using our website or services, you agree to the terms of this Privacy Policy.
Who We Are
Northern Medical Center, located at 14 Jason Place, Suite 201, Middletown, NY 10940, is a non-profit health center providing integrative healthcare, including primary care, pediatrics, mental health, acupuncture, and other services. Our mission is to deliver compassionate, comprehensive care that treats the whole person—body, mind, and spirit.
Information We Collect
We collect the following types of information:
1. Protected Health Information (PHI)
- What We Collect: Information related to your health, such as medical history, diagnoses, treatments, test results, billing, and insurance details, collected during your care at Northern Medical Center.
- How We Collect It: Through patient intake forms, medical records, telehealth interactions, and communications with our healthcare providers.
2. Website Usage Information
- Personal Data: If you use our contact forms, patient portal, or sign up for our email list, we may collect your name, email address, phone number, and other details you provide.
- Cookies and Tracking: Our website uses cookies to enhance user experience and track browsing activity. Cookies are small files stored on your device (computer, phone, or tablet) that collect details like your IP address, browser type, and pages visited. For more details, see our Cookie Policy.
- Analytics: We use tools like Google Analytics to collect anonymized data about website usage, such as page views and session duration.
3. Other Information
- Comments and Feedback: If you leave comments or feedback on our website, we collect the data shown in the form, your IP address, and browser user agent string to help detect spam.
- Embedded Content: Our website may include embedded content (e.g., videos, maps) from third-party sites, which may collect data as if you visited those sites directly.
How We Use Your Information
We use your information for the following purposes, in compliance with HIPAA and Article 28 regulations:
1. Treatment
- To provide, coordinate, and manage your healthcare, including sharing PHI with our providers, specialists, or pharmacists involved in your care.
- Example: Sharing test results with a consulting physician to determine your treatment plan.
2. Payment
- To process billing, insurance claims, and payments for services rendered.
- Example: Submitting claims to your insurance provider, such as Aetna or Medicare, for reimbursement.
3. Healthcare Operations
- To support internal operations, such as quality improvement, staff training, and compliance with legal requirements.
- Example: Reviewing patient records to assess care quality.
4. Communication
- To send appointment reminders, treatment alternatives, or health-related information (e.g., newsletters, event invitations).
- To respond to inquiries submitted via our contact form or email (info@northernmedical.org).
5. Legal and Regulatory Compliance
- To comply with federal, state, or local laws, including HIPAA and New York Public Health Law Article 28 requirements.
- Example: Reporting vital statistics or communicable diseases to public health authorities.
6. Marketing and Fundraising
- Limited use of PHI for marketing (e.g., face-to-face communications about services) or fundraising (e.g., contacting you about donations to support our non-profit mission). You may opt out of fundraising communications by contacting our Compliance Officer.
How We Disclose Your Information
We may disclose your information as follows, ensuring compliance with HIPAA and other laws:
1. Without Authorization
- Treatment, Payment, or Operations: To providers, insurers, or business associates (e.g., billing companies) under HIPAA-compliant agreements.
- Required by Law: For public health activities, judicial proceedings, law enforcement, or organ donation, as permitted by law.
- Health Oversight: To agencies like the New York Department of Health for audits or investigations.
- Serious Threats: To prevent harm to you or others (e.g., reporting a safety threat).
2. With Your Authorization
- For uses not covered above, such as sharing psychotherapy notes or using PHI for third-party marketing, we will obtain your written authorization. You may revoke this authorization at any time by contacting our Compliance Officer, except for actions already taken.
3. With Opportunity to Object
- Facility Directory: We may include your name, room number, general condition, and religious affiliation in our patient directory, shared with clergy or visitors who ask for you by name, unless you object.
- Family/Friends: We may share PHI with family or friends involved in your care or payment, unless you object or are not present, in which case we will use professional judgment.
Your Rights Regarding Your Information
Under HIPAA and New York law, you have the following rights:
- Access: Request to view or obtain copies of your PHI. Contact our Medical Records Department at (845) 800-5118.
- Amendment: Request corrections to your PHI if you believe it is inaccurate.
- Accounting of Disclosures: Request a list of certain disclosures of your PHI.
- Restriction: Request limits on how we use or disclose your PHI, though we may not always be able to comply.
- Confidential Communications: Request alternative methods of communication (e.g., a different phone number).
- Opt-Out: Opt out of fundraising communications by contacting our Compliance Officer.
- Data Portability: Request an exported file of your personal data from our patient portal.
To exercise these rights, contact our Compliance Officer at (845) 800-5118 or info@northernmedical.org.
How We Protect Your Information
- Security Measures: We use physical, technical, and administrative safeguards, such as encryption, secure servers, and restricted access, to protect PHI and personal data.
- Business Associates: Third parties (e.g., billing services) sign Business Associate Agreements to ensure HIPAA compliance.
- Data Breach Procedures: In case of a breach, we will notify affected individuals and authorities as required by law.
Cookies and Tracking
- Cookies: We use cookies for website functionality (e.g., saving login preferences) and analytics. Functional cookies last up to one year; login cookies last two days unless you select “Remember Me” (two weeks). You can manage cookie preferences via your browser settings.
- Third-Party Cookies: Embedded content (e.g., YouTube videos) may set cookies. Review third-party privacy policies (e.g., Google’s at https://policies.google.com/privacy).
- Do Not Track: Our website honors “Do Not Track” signals if enabled in your browser.
Data Retention
- PHI: Retained as required by New York law (e.g., 6 years for adults, until age 21 for minors) and HIPAA.
- Website Data: Comments and metadata are retained indefinitely for moderation purposes. Other data (e.g., contact form submissions) is retained for up to one year unless required for legal purposes.
Third-Party Data Sharing
- Analytics Providers: We share anonymized data with tools like Google Analytics.
- Embedded Content: Third-party sites (e.g., Gravatar for comments) may collect data. See their privacy policies for details.
- Business Associates: We share PHI with entities like billing companies under strict confidentiality agreements.
Data Breach Notification
In the event of a data breach, we will notify affected individuals, the U.S. Department of Health and Human Services, and, if required, the media, per HIPAA regulations.
Your Choices
- Opt-Out: To stop receiving marketing emails, click “Unsubscribe” in our emails or contact us at info@northernmedical.org.
- Cookies: Disable cookies in your browser, though this may affect website functionality.
- Fundraising: Opt out by contacting our Compliance Officer in writing.
Complaints
If you believe your privacy rights have been violated, you may:
- Contact our Compliance Officer at (845) 800-5118 or info@northernmedical.org.
- File a complaint with the U.S. Department of Health and Human Services Office for Civil Rights at https://www.hhs.gov/ocr/complaints or by mail at 200 Independence Avenue, S.W., Washington, D.C. 20201. Complaints must be filed within 180 days of the violation.
We will not retaliate against you for filing a complaint.
Changes to This Privacy Policy
We may update this Privacy Policy to reflect changes in our practices or legal requirements. The updated policy will be posted on our website with a revised effective date. Please review it periodically.
Contact Us
For questions or to exercise your privacy rights, contact:
Northern Medical Center
Compliance Officer
14 Jason Place, Suite 201
Middletown, NY 10940
Phone: (845) 800-5118
Email: info@northernmedical.org